   (:require [ring.middleware.basic-authentication :refer [wrap-basic-authentication]]
             [clj-http.client :as client]
             [clojure.tools.logging :as log]
-            [io.sarnowski.swagger1st.util.api :as api]))
+            [io.sarnowski.swagger1st.util.api :as api]
+            [clj-time.core :as t])
+  (:import (java.io IOException)))
 
 ;; functions that generate security handler
 
-(defn- deny-response
+(defn- unauthorized
   "Send forbidden response."
   [reason]
-  (log/warnf "ACCESS DENIED because %s." reason)
+  (log/warnf "ACCESS DENIED (unauthorized) because %s." reason)
+  (api/error 401 "Unauthorized"))
+
+(defn- forbidden
+  "Send forbidden response."
+  [reason]
+  (log/warnf "ACCESS DENIED (forbidden) because %s." reason)
   (api/error 403 "Forbidden"))
 
 (defn allow-all

  "Checks with a tokeninfo endpoint for the token's validity and returns the session information if valid."
  [tokeninfo-url access-token]
  ; TODO make connection pool configurable!
  (let [response (client/get tokeninfo-url
                             {:query-params     {:access_token access-token}
                              :throw-exceptions false
                              :as               :json-string-keys})
        body (:body response)]
    (if (= 200 (:status response))
      body
      nil)))

(defn check-consented-scopes

            ; check scopes
            (if (check-scopes-fn tokeninfo requirements)
              (assoc request :tokeninfo tokeninfo)
              (forbidden "scopes not granted"))
            (unauthorized "invalid access token"))
          (api/error 503 "token info misconfigured")))
      (unauthorized "no access token given"))))
